Top Risks

• Privacy policy is generic Google policy admitting data collection and third-party sharing, not scoped to this extension.
• innerHTML DOM-XSS sinks in 4 content scripts with no CSP set on the extension.
• Small user base (140 installs) limits review scrutiny of single-host financial-site integration.
• Developer name absent; accountability rests on verified publisher badge and upforce.tech domain alone.

Evidence

• permissions crx scripting+storage+notifications; host access scoped to zone.definedgesecurities.com only.
• privacy_policy store Generic Google policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• verified_publisher store Verified publisher badge present; dev domain upforce.tech resolves, certs since 2019.
• code_findings crx 4 innerHTML sinks; csp_present=false triggers elevated DOM-XSS weighting.
• network crx 12 external hosts, all definedgesecurities.com/definedge.com; MV3 so no CSP penalty.
• threat_intel api No bad-host, monetization, or affiliate hits; sibling_count=0.
• maintenance store Updated Oct 18 2026; months_since_update=0.
• cve api cve_findings_raw empty; no bundled JS libraries detected.

Permissions Breakdown

• scripting medium Script injection capability, but scoped to single host zone.definedgesecurities.com.
• storage low Standard local storage; no sensitive data access implied.
• notifications low Notifications without broad host access; low abuse potential.

Pillar Scores

Bookkeeping